GHSA-hpr5-wp7c-hh5q
Cross-Site Scripting in mrk.js
Versions of mrk.js before 2.0.1 are vulnerable to cross-site scripting (XSS) when markdown is converted to HTML.
Recommendation
Update to version 2.0.1 or later and use mark.sanitizeURL() for any src and href attributes when extending the markdown.
What each source reports
GitHub AdvisoriesNo score
Cross-Site Scripting in mrk.js
Versions of mrk.js before 2.0.1 are vulnerable to cross-site scripting (XSS) when markdown is converted to HTML.
Recommendation
Update to version 2.0.1 or later and use mark.sanitizeURL() for any src and href attributes when extending the markdown.
- Record
GHSA-hpr5-wp7c-hh5q- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Cross-Site Scripting in mrk.js
Versions of mrk.js before 2.0.1 are vulnerable to cross-site scripting (XSS) when markdown is converted to HTML.
Recommendation
Update to version 2.0.1 or later and use mark.sanitizeURL() for any src and href attributes when extending the markdown.
- Record
GHSA-hpr5-wp7c-hh5q- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mrk.jsnpm | before 2.0.1 | 2.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-hpr5-wp7c-hh5q is a vulnerability with no CVSS score yet in mrk.js, published September 1, 2020. No source lists public exploit code. Fixed in mrk.js 2.0.1.